CCNA Network Services and Security Practice Test 35 — 15 Questions

Question 1

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to ISP router, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The internal network uses 192.168.1.0/24 and needs to access the internet. Configure NAT overload on R1 so that internal hosts are translated to the IP address of GigabitEthernet0/0 when accessing the internet.

Accepted Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside. NAT overload (PAT) allows multiple internal hosts to share a single public IP by using different source ports. The ACL identifies the internal network, and the interfaces are marked as inside/outside. The 'overload' keyword enables port address translation. Option B fails because it translates to the wrong interface (GigabitEthernet0/1) instead of the public-facing interface (GigabitEthernet0/0). Option C is missing the required 'overload' keyword, so it performs dynamic NAT without PAT, which is insufficient for multiple hosts. Option D uses an overly broad ACL ('permit any') that does not match only the internal network (192.168.1.0/24) as required by the stem.

Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Answer

R1(config)# access-list 1 permit any
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Question 2

You are connected to R1 via the console. R1 is a router that needs to provide DHCP services for hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The DHCP server is located on VLAN 10 at 192.168.10.100, but hosts on VLAN 20 cannot reach it directly. Configure R1 to forward DHCP broadcasts from VLAN 20 to the DHCP server.

Accepted Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip helper-address 192.168.10.100. The ip helper-address command enables the router to forward UDP broadcasts (including DHCP) to a specific server. Placing it on the VLAN 20 subinterface ensures that DHCP requests from VLAN 20 are unicast to the server on VLAN 10.

Answer

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip helper-address 192.168.10.100

Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip dhcp relay information option

Answer

ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1

Question 3

You are connected to R1 via the console. R1's GigabitEthernet0/0 (192.168.1.1/24) connects to the management network, and GigabitEthernet0/1 (10.0.0.1/30) connects to the core. You need to restrict SSH access to R1 from only the management subnet 192.168.1.0/24. Additionally, SSH should be configured with a domain name 'example.com' and a modulus of 2048 bits. The username 'admin' with password 'Cisco123' should be created for SSH login.

Accepted Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048. Option A correctly configures an access list to permit the management subnet, applies it inbound on the VTY lines, sets transport input to SSH only, uses local authentication with a username and secret, sets the domain name, and generates RSA keys with 2048-bit modulus. This meets all requirements: restrict SSH to the management subnet, configure domain name and modulus, and create the user.

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT out
 transport input ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input telnet ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input ssh
 login local
 username admin password Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Question 4

You are connected to R1 via the console. R1 is a router that connects to the internet via GigabitEthernet0/0 (198.51.100.1/30) and to the internal network via GigabitEthernet0/1 (10.1.1.1/24). You need to implement a security policy that permits HTTP traffic (port 80) from the internal network to a web server at 10.1.1.100, and denies all other traffic from internal hosts to the internet. The ACL should be named 'INTERNET-FILTER' and applied inbound on GigabitEthernet0/1.

Accepted Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip 10.1.1.0 0.0.0.255 any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in. The named extended ACL filters traffic based on source, destination, and protocol. The permit allows HTTP from internal to the web server. The deny blocks all other internal-to-internet traffic. Applying it inbound on the internal interface filters traffic as it enters the router.

Answer

ip access-list standard INTERNET-FILTER
 permit 10.1.1.0 0.0.0.255
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp host 10.1.1.100 10.1.1.0 0.0.0.255 eq 80
 deny ip any any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip any any
!
interface GigabitEthernet0/0
 ip access-group INTERNET-FILTER in

Question 5

Which three of the following are characteristics of DHCP snooping on a Cisco switch? (Choose three.)

Accepted Answer

It differentiates trusted and untrusted ports to filter DHCP messages.. DHCP snooping is a security feature that filters untrusted DHCP messages by differentiating trusted and untrusted ports. It builds and maintains a DHCP snooping binding database to track valid IP-to-MAC address assignments. Additionally, it prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, typically using the 'ip dhcp snooping limit rate' command.

Answer

It requires all DHCP servers to be connected to untrusted ports.

Answer

It replaces the DHCP server's IP address with a static route.

Answer

It encrypts DHCP traffic between the client and the server.

Question 6

Which three options are true regarding the operation of Dynamic ARP Inspection (DAI) on a Cisco switch? (Choose three.)

Accepted Answer

DAI validates ARP packets based on the DHCP snooping binding database.. Dynamic ARP Inspection (DAI) validates ARP packets by intercepting them on untrusted ports and checking the MAC-to-IP address binding against the DHCP snooping binding database. If the binding is invalid or missing, DAI drops the packet, preventing ARP spoofing attacks. This is why all three statements are correct: DAI relies on the DHCP snooping database, drops invalid bindings, and is enabled on untrusted ports facing end hosts.

Answer

DAI relies on the MAC address table to validate ARP requests.

Answer

DAI encrypts ARP replies to prevent eavesdropping.

Answer

DAI prevents rogue DHCP server attacks by inspecting DHCP offers.

Question 7

Which three of the following statements about Network Address Translation (NAT) are correct? (Choose three.)

Accepted Answer

Static NAT provides a one-to-one mapping between a private IP and a public IP.. Static NAT provides a one-to-one mapping between a private IP and a public IP, ensuring that a specific internal host always uses the same public address. Dynamic NAT uses a pool of public IP addresses assigned on a first-come, first-served basis, so internal hosts compete for available addresses. PAT (Port Address Translation) allows multiple internal hosts to share a single public IP by differentiating sessions via unique port numbers, which is the most common form of NAT used in home and small office routers.

Answer

Dynamic NAT always assigns the same public IP to a given internal host.

Answer

NAT eliminates the need for any routing in a network.

Answer

PAT requires a unique public IP for every concurrent session.

Question 8

Which four of the following are true statements regarding the operation of DHCP snooping on a Cisco switch? (Choose all that apply. There are four correct answers.)

Accepted Answer

DHCP snooping builds and maintains a DHCP snooping binding database (also called a binding table).. The four correct statements are true because DHCP snooping is a security feature that operates by classifying switch ports as trusted or untrusted. By default, all ports are untrusted, meaning they cannot send DHCP server messages (OFFER, ACK, NAK) unless explicitly configured as trusted. Rate-limiting DHCP messages on untrusted ports mitigates DHCP starvation attacks, and the binding database (MAC-to-IP mapping) is built from DHCP ACK messages to prevent IP spoofing. The incorrect statement "DHCP snooping requires an external DHCP server to be configured on the switch" is false because DHCP snooping itself does not require the switch to act as a DHCP server; it simply relies on DHCP messages from a legitimate server reachable through a trusted port.

Answer

DHCP snooping prevents rogue DHCP servers by allowing only authorized servers on any port.

Answer

DHCP snooping requires an external DHCP server to be configured on the switch.

Question 9

Which three of the following are characteristics of DHCP snooping? (Choose three.)

Accepted Answer

It builds and maintains a DHCP snooping binding database.. DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database to track valid IP-to-MAC address assignments. It prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, and it validates DHCP client MAC addresses against the source MAC in the Ethernet frame to prevent MAC spoofing. These three functions directly correspond to the correct answer options.

Answer

It automatically enables IP source guard when configured globally.

Answer

It allows DHCP server messages from untrusted ports if the source MAC matches.

Answer

It filters untrusted DHCP messages on trusted ports.

Question 10

Which three of the following are security best practices for implementing AAA on a Cisco router? (Choose three.)

Accepted Answer

Enable AAA new-model before configuring any AAA methods.. Using a local username database as a fallback method ensures that if the AAA server becomes unreachable, administrators can still authenticate via the router's local accounts. This is a standard best practice to prevent lockout. Enabling 'aaa new-model' is mandatory before any AAA configuration, as it activates the AAA subsystem on the router. TACACS+ is the preferred protocol for command authorization and accounting because it encrypts the entire packet and supports per-command authorization, unlike RADIUS which only encrypts the password.

Answer

Disable the enable secret password when using AAA servers.

Answer

Set the authentication login method to 'none' for console access.

Answer

Use RADIUS for command-level authorization.

Question 11

Which three features are used to mitigate Layer 2 security threats on a Cisco switch? (Choose three.)

Accepted Answer

DHCP snooping to build a trusted binding database.. Dynamic ARP Inspection (DAI) is correct because it validates ARP packets against the DHCP snooping binding table, dropping ARP spoofing/poisoning attempts that enable man-in-the-middle attacks at Layer 2. DHCP snooping is correct because it builds and maintains the trusted binding database of IP-to-MAC-to-port-to-VLAN mappings that DAI relies on, and it also rate-limits and filters rogue DHCP server messages. BPDU guard is correct because it err-disables access ports that receive BPDUs, preventing an attacker from injecting a rogue switch or manipulating STP topology. PortFast is not a mitigation feature — it only speeds up STP convergence on edge ports and actually increases risk unless paired with BPDU guard. EtherChannel load balancing is a bandwidth/availability feature, not a Layer 2 threat mitigation. Using VLAN 1 as the native VLAN on trunks is a poor practice that can enable VLAN hopping, so it does not mitigate threats.

Answer

EtherChannel load balancing to increase bandwidth.

Answer

VLAN 1 as the native VLAN on trunk ports for management.

Answer

PortFast on all access ports to prevent STP convergence delays.

Question 12

Which four of the following are characteristics or functions of a stateless firewall, such as an extended access control list (ACL) on a Cisco router? (Choose four.)

Accepted Answer

It examines each packet individually without considering the state of a connection.. A stateless firewall, such as a Cisco extended ACL, processes each packet independently without tracking the state of a connection. It makes filtering decisions solely based on static fields in the packet header, such as source/destination IP addresses and port numbers, and applies rules in a sequential order until a match is found. This is why options about per-packet inspection, IP/port filtering, and sequential rule processing are correct.

Answer

It automatically allows return traffic for established connections.

Answer

It can inspect the application-layer payload to detect malicious content.

Question 13

Which four of the following are best practices for securing network services and devices? (Choose four.)

Accepted Answer

Implement role-based access control (RBAC) to limit user privileges.. Disabling unused ports, implementing role-based access control (RBAC), enabling logging, and keeping firmware updated are all critical security best practices: they reduce the attack surface, limit user permissions, detect threats, and patch known vulnerabilities. Using Telnet is insecure because it transmits data in cleartext, unlike SSH. Placing all devices on the same VLAN undermines network segmentation and allows lateral movement by attackers.

Answer

Use Telnet for remote management because it is simpler to configure than SSH.

Answer

Place all network devices on the same VLAN to simplify security policy enforcement.

Question 14

A network administrator is troubleshooting an issue where hosts in the 192.168.20.0/24 subnet cannot reach the Internet, while hosts in 192.168.10.0/24 can. The router is configured for PAT overload using a dynamic pool on the outside interface. The administrator collects the configuration shown in the exhibit. What is the most likely cause of the connectivity problem for the 192.168.20.0/24 subnet?

Accepted Answer

The wildcard mask in access list 20 is incorrect; it matches only the network address.. The issue is that access list 20, used to define which internal addresses are eligible for NAT, has a wildcard mask of 0.0.0.0. This wildcard mask matches only the exact address 192.168.20.0, not the entire 192.168.20.0/24 subnet. For a /24 subnet, the correct wildcard mask should be 0.0.0.255, which would match all addresses from 192.168.20.1 to 192.168.20.254. Because the ACL matches only the network address (192.168.20.0), no host traffic from that subnet is translated, breaking Internet connectivity.

Answer

The NAT pool does not have enough IP addresses to support both subnets.

Answer

Interface GigabitEthernet0/2 is missing the ip nat inside command.

Answer

Access list 10 is incorrectly applied to the NAT pool, causing a conflict.

Question 15

Drag and drop the following steps into the correct order to configure and apply an extended IPv4 ACL on a Cisco router to block Telnet traffic from subnet 192.168.1.0/24 to host 10.0.0.1 and permit all other IP traffic.

Accepted Answer

Identify the traffic to filter (deny Telnet from 192.168.1.0/24 to 10.0.0.1) and determine that the ACL should be applied inbound on interface GigabitEthernet0/1.. Correct order: 1) Identify the traffic to filter and the interface/direction because this planning determines all subsequent configuration choices. 2) Enter global configuration mode to access ACL definition. 3) Configure the deny statement first — ACLs are processed top-down, so the specific deny must precede the general permit to actually block the unwanted traffic. 4) Add the permit statement after the deny to allow everything else. 5) Enter interface configuration mode to attach the ACL to a specific port. 6) Apply the ACL with the correct direction (inbound) using the ip access-group command, which activates the filtering. 7) Verify the ACL is correctly applied to confirm the configuration is functioning as intended.